ZephyrProject Zephyr up to 4.4.1 I2C Target Driver i2c_ite_it51xxx.c target_i2c_isr_fifo w_index out-of-bounds write

Summaryinfo

A vulnerability identified as very critical has been detected in ZephyrProject Zephyr up to 4.4.1. This affects the function target_i2c_isr_fifo of the file drivers/i2c/i2c_ite_it51xxx.c of the component I2C Target Driver. This manipulation of the argument w_index causes out-of-bounds write. This vulnerability is tracked as CVE-2026-14986. The attack is restricted to local execution. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as very critical was found in ZephyrProject Zephyr up to 4.4.1. Affected by this vulnerability is the function target_i2c_isr_fifo of the file drivers/i2c/i2c_ite_it51xxx.c of the component I2C Target Driver. The manipulation of the argument w_index with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied write data into the fixed-size data->target_in_buffer inside its target FIFO interrupt handler target_i2c_isr_fifo() in drivers/i2c/i2c_ite_it51xxx.c. The copy loop stores to target_in_buffer[i + data->w_index] and only checks data->w_index against sizeof(data->target_in_buffer) after the write has already completed, so the bounds check cannot prevent the overflow. The running index data->w_index accumulates count bytes on every FIFO-fill interrupt of an ongoing transaction and is reset to zero only on a STOP or timeout condition. An I2C host that streams a single write transaction longer than the buffer (default CONFIG_I2C_TARGET_IT51XXX_MAX_BUF_SIZE = 256 bytes) drives data->w_index past the end of the buffer, and each subsequent host byte is written out of bounds into the adjacent data->target_out_buffer and following static device data. The trigger is a malicious or misbehaving I2C master on the same bus (for example a compromised application processor or a rogue device on an exposed I2C bus); no software privilege on the victim is required and the handler runs in the target's kernel/firmware context. Because both the written values and the overflow length are attacker-controlled, this is an out-of-bounds write that can crash the controller or be shaped toward code execution. The fix adds a pre-write bounds check in target_i2c_fifo_read_to_buf() that aborts and resets the FIFO before any out-of-bounds store.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-14986 since 07/07/2026. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/15/2026).

Upgrading to version 4.4.2 eliminates this vulnerability. Applying the patch eac92173cf13bba4e6c6eea3460ee6085513d86d is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ZephyrProject

Name

• Zephyr

Version

• 4.4.0
• 4.4.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion